Malware Analysis and Threat Intelligence, Interview Questions.

Viruses and worms (self-replicating), trojans (disguised), ransomware (extortion by encryption or data theft), spyware and stealers, backdoors and remote access trojans, rootkits (hide presence), botnets, loaders and droppers, and fileless or living-off-the-land activity.

Static analysis examines a sample without running it (strings, headers, imports, hashes, disassembly). Dynamic analysis runs it in a controlled sandbox and observes behaviour: files, registry, processes and network. Combine both.

Samples can spread, call home and damage systems. Use isolated virtual machines with snapshots, no connection to production networks (or a simulated internet), and strict handling procedures.

Analysed, contextual information about adversaries and their methods that supports decisions. Levels are strategic, operational, tactical and technical.

Tactics (goals), techniques (methods) and procedures (specific implementations) that describe how an adversary operates. They are catalogued in MITRE ATT&CK.

A scheme for sharing sensitivity: TLP:RED (named recipients only), TLP:AMBER (limited organisational sharing), TLP:GREEN (community) and TLP:CLEAR (public). It makes sharing rules explicit.

Record hashes, identify file type, check reputation sources, read strings and metadata, check the signature and compile time, view imports for suspicious capabilities, and then detonate in a sandbox to see behaviour and network indicators. Produce IOCs and detection logic from the findings.

# safe, read-only first look at a sample inside an isolated analysis VM
sha256sum sample.bin
file sample.bin
strings -n 8 sample.bin | head -50

Packing compresses or encrypts code to hinder static analysis and signature matching. Analysts look for high entropy and few imports, then unpack by running in a controlled environment and dumping from memory, or by using unpacking tools. Obfuscated scripts are decoded step by step.

Persistence by monitoring Run keys, scheduled tasks, services and startup items created during detonation. C2 by recording DNS, HTTP and TLS connections, beacon intervals and certificates, which become indicators and detection content.

Extract behaviours (process chains, registry changes, mutexes, network patterns) and robust strings, write YARA rules for files and memory, Sigma for host logs, Suricata for network traffic, and test them for false positives against clean data.

rule Example_Suspicious_Loader
{
  meta:
    description = "illustrative rule, tune before use"
  strings:
    $s1 = "CreateRemoteThread" ascii
    $s2 = "VirtualAllocEx" ascii
    $cfg = { 4D 5A 90 00 }
  condition:
    $cfg at 0 and all of ($s*)
}

It describes an intrusion event by adversary, capability, infrastructure and victim. Pivoting across these features connects events into campaigns and supports attribution reasoning.

Hashes and IPs are quick to change and may be shared hosting. Domains and certificates last a bit longer. TTPs last longest. Attach confidence, source and expiry to every indicator and prefer behaviour-based rules.

Questions stakeholders need answered (which actors target our sector, which vulnerabilities matter now). They direct collection and analysis so the output is useful instead of a feed of everything.

Use ratings for source reliability and information credibility (the Admiralty system), look for corroboration, check for first-hand access, consider bias and motive, and state confidence levels in your assessment.

Direction (requirements), collection, processing, analysis, dissemination and feedback. Feedback closes the loop so products improve.

Attackers reuse tools, buy access, imitate others and share infrastructure. Attribution should state confidence with evidence and rarely matters for immediate defence: detecting and blocking the behaviour matters more than naming the actor.

Ingest curated feeds into the SIEM and EDR with scoring and expiry, map actor TTPs to detection coverage, drive hunts from new reports, brief teams on relevant campaigns, and measure how intelligence led to detections or prevented incidents.

Collect samples and ransom notes, extract configuration and infrastructure, track affiliate behaviour and leak sites through public reporting, map TTPs, and distribute detection and hardening guidance. Never engage with criminals outside legal and organisational approval.

Malware may delay execution, check for virtual machine artefacts or user activity, or require specific triggers. Defenders use longer runs, more realistic environments, instrumentation at multiple levels and manual analysis when automated runs show too little behaviour.

Follow a handling policy: isolated lab, access controls, no live execution on production networks, legal review before sharing samples or engaging with infrastructure, and secure disposal. Respect licensing and laws on possession and sharing.

Preserve the file and hash it, check reputation, analyse statically and in a sandbox, extract indicators, search the estate for matches, hand findings to incident response for scope, and write detections. Report confidence and unknowns clearly.

Extract techniques and indicators, check coverage in your detections, retro-hunt in logs for indicators and behaviours, patch or mitigate any exploited vulnerabilities, and brief the SOC and leadership with a short actionable summary.

Remove sensitive internal details, check sharing rules and TLP markings, review with legal if needed, and share only what helps others detect the threat.